###
 # @Description: 
 # @Version: 2.0
 # @Autor: gang
 # @Date: 2020-09-23 15:28:10
 # @LastEditors: gang
 # @LastEditTime: 2020-09-23 17:02:00
### 
#!/bin/bash

:<<EOF
linux 优化方案
    安装系统时精简安装包（最小化安装）
    配置国内的高速yum源
    禁止开机启动不需要的服务
    优化系统内核参数/etc/sysctl.conf
    增加系统文件描述符、堆栈等配置
    禁止root远程登陆，修改ssh端口号为特殊端口，禁止DNS及空密码
    有外网IP的机器要开启、配置防火墙，仅对开启需要提供服务的端口、配置或关闭SELinux
    清除无用的默认系统账户或组
    锁定敏感文件/etc/passwd(非必须)
    配置服务器和互联网时间同步
    初始化用户，并配置sudo对普通用户权限的控制
    修改系统字符集
    补装系统软件及升级系统到最新
EOF
export PATH=$PATH:/bin:/sbin:/usr/sbin

if [ "$UID" -ne "0" ]
    then
    echo "Please run this script by root"
    exit 1
fi

#/usr/bin/systemctl
SYSTEMCTL=`which systemctl`

#更换yum源
function mod_yum(){
    if [ -e /etc/yum.repos.d/CentOS-Base.repo ]
        then
        mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup && \
        wget -O /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
    fi
}

#关闭防火墙
function close_iptables(){
    # /usr/bin/systemctl stop firewalld.service && \
    /usr/bin/systemctl status firewalld.service | grep running
    # echo $?
    if [ $? -eq 0 ]
        then
        /usr/bin/systemctl stop firewalld.service
        echo "防火墙正在运行"
    else
        echo "防火墙已关闭"
    fi
}

#关闭selinux
function close_selinux(){
    sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
}

#设置文件描述符
function open_file_limit(){
    local limitsconf=/etc/security/limits.conf
    if [ `grep 65535  ${limitsconf}| wc -l` -lt 1 ]
        then
        action echo "*    -    nofile    65535" >> ${limitsconf}
    fi
}


main(){
    mod_yum
    close_iptables
    close_selinux
    open_file_limit
}
main

